I am still looking at everything, thanks for being so open :)
Just as a couple of quick questions though:
1. Any reason krikkit.local is not a 'local' domain so that it will by-pass
the dnslookup router (or an additional exception)?
2. Have you found any other 'Unrouteable address' errors in the logs for
messages that use the dnslookup router that should have been delivered?